Threat actors have begun scanning the Internet for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution. Oracle released patches on October 20, 2026; threat intelligence firm Defused Cyber detected reconnaissance probes on October 27. Over 670 Internet-exposed EBS instances have been identified, primarily in the United States.
ShinyHunters threat group has actively exploited three chained vulnerabilities in Oracle PeopleSoft (CVE-2026-35273) enabling unauthenticated remote code execution. Initial exploitation began in May 2026; a renewed, larger wave in September 2026 targeted dozens of systems across education, technology, healthcare, agriculture, transport, and government sectors. The vulnerability chain combines an SSRF in the Integration Gateway with misplaced trust in loopback addresses, allowing attackers to reach the internal Environment Management Hub and achieve code execution without authentication.
Oracle released its October 2026 Critical Patch Update addressing 1,295 security patches across its enterprise portfolio, including 4 patches for Oracle HealthCare Applications. Four of the patches for Oracle HealthCare Applications are remotely exploitable without authentication, indicating critical exposure. Organizations running Oracle HealthCare Applications should prioritize applying these patches immediately.
Oracle Health suffered a major data breach affecting approximately 20 million individuals. Unauthorized access to legacy Cerner systems began in January 2025 using stolen customer credentials; the company discovered the breach in February 2025, and it became public in March 2025. A Texas Attorney General filing disclosed the 20 million figure on October 5, 2026. Attackers obtained records from older Cerner infrastructure still awaiting migration to Oracle's cloud platform.
A major breach of Oracle Health's legacy Cerner server exposed medical records, addresses, and Social Security numbers of approximately 20 million people. The unauthorized access occurred on or around February 20, 2025, on an old legacy server not yet migrated to Oracle Cloud. Oracle initially denied a breach but later privately confirmed it to affected customers. The Texas Attorney General released information confirming the 20-million-person impact scale. Affected customers include the U.S. Department of Defense and Department of Veterans Affairs.
ShinyHunters threat group has resumed mass exploitation of a critical vulnerability in Oracle PeopleSoft, bypassing mitigations deployed after initial attacks in May-June 2026. The threat actor has targeted dozens of systems across higher education, healthcare, technology, agriculture, transport, and public administration sectors in multiple countries. ShinyHunters claimed to have accessed FBI data through the vulnerability; the FBI confirmed it is actively investigating the breach.
CVE-2026-21962, a maximum-severity improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (CVSS 10.0), has been added to CISA's Known Exploited Vulnerabilities catalog following confirmed active exploitation. The vulnerability allows unauthenticated attackers with network access via HTTP to unauthorizedly access, modify, or delete critical data. Patches were released in January 2026, and exploitation attempts have been documented by GreyNoise and CloudSEK.
A 2025 Oracle Health/Cerner data breach has now been disclosed as affecting 28 hospitals and health systems. The breach exposed patient and organizational data across a significant portion of healthcare providers relying on Oracle Health's EHR platform, representing one of the largest healthcare data compromises linked to this vendor.
Oracle's July 2026 Critical Patch Update permanently fixed CVE-2026-35273, a privilege-escalation zero-day in PeopleSoft PeopleTools (CVSS 9.8) that ShinyHunters actively exploited to breach over 100 organizations worldwide—primarily universities—between May 27 and June 9, 2026. The vulnerability enabled unauthenticated remote code execution; 68% of affected organizations were higher-education institutions, with confirmed data exposures including 40+ gigabytes from University of Nottingham covering nearly 500,000 students. Oracle issued an out-of-band alert on June 10 after exploitation was already underway for two weeks, underscoring disclosure delays in critical enterprise software.
Oracle released its July 2026 Critical Patch Update on July 22, 2026, shipping 1,449 patches addressing over 1,200 vulnerabilities across 30+ product families including Database, Fusion Middleware, MySQL, E-Business Suite, JD Edwards, and Oracle Communications. A significant share are remotely exploitable without authentication and enable RCE, privilege escalation, or data breach. AI systems were used extensively to accelerate vulnerability discovery.
CISA added CVE-2026-46817, a critical improper privilege management vulnerability in Oracle E-Business Suite's Oracle Payments component, to its Known Exploited Vulnerabilities catalog on July 15, 2026. The flaw allows unauthenticated attackers with HTTP network access to fully compromise Oracle Payments systems without authentication. Active exploitation has been confirmed in the wild. CISA ordered federal agencies to patch by July 18, 2026; Oracle issued fixes in its May 2026 Critical Security Patch Update.
Oracle Health's legacy Cerner systems experienced a data breach in January 2025 affecting patient data at at least 17 hospitals across the United States, including Sharp Tri-City Medical Center, AdventHealth, Baptist Health South Florida, and others. Notification to affected patients has been ongoing through July 2026, with health systems completing their own investigations and legal action underway alleging Oracle Health failed to adequately protect patient data and delayed notification.
A critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite is under active exploitation in the wild. Approximately 900–950 internet-facing EBS instances have been identified globally, with DefusedCyber observing real-world attack attempts. The flaw enables remote code execution and affects systems handling sensitive financial, HR, and operational data. Attackers appear to have reverse-engineered Oracle's patch before public disclosure.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain a critical remote code execution vulnerability (CVE-2026-35273) in the Updates Environment Management component. The vulnerability allows unauthenticated remote attackers to execute arbitrary code via HTTP. Exploitation is actively occurring in the wild; immediate patching is required.
ShinyHunters claimed breach of Oracle PeopleSoft servers at over 100 organizations including universities, exfiltrating student records, financial aid data, and administrative information. The group exploited a vulnerability in PeopleSoft to achieve mass compromise; attackers obtained personal data including home addresses, phone numbers, emails, and dates of birth from educational institutions.
CVE-2026-46839, a critical vulnerability in Oracle REST Data Services (ORDS) Core component, allows low-privileged authenticated attackers to execute arbitrary code and gain full system control via path traversal. Affects versions 24.2.0–26.1.0 with CVSS 9.9. Oracle released a patch in May 2026; exploitation complexity is low and no public PoC exists as of early June 2026, but technical details suggest rapid weaponization is likely.
CISA added CVE-2024-21182, a critical Oracle WebLogic Server vulnerability, to its Known Exploited Vulnerabilities catalog on June 1, 2026, after confirming active exploitation in the wild. The flaw allows unauthenticated attackers to gain unauthorized access via T3 and IIOP protocols. CISA ordered federal agencies to patch by June 4, 2026, and strongly recommends organizations apply mitigations immediately to prevent compromise of WebLogic-dependent services including potential Oracle Health infrastructure.